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DECISION ON APPEAL 
This appeal is from the final rejection of claims 9-17, 22- 
29, 38-46, 51-58, 60, 62 and 63, which are all of the pending 
claims . 

THE INVENTION 

The appellants claim a method, apparatus and computer 
product for managing an information request. Claims 9 and 22, 
which claim the method, are illustrative: 

9. A method in a data processing system for managing an 
information request, comprising : 

establishing a session, including authenticating a client 
based on a presented credential; 
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generating a session identification in response to the 
session being established; 

associating the presented credential with session data; 

sending the session identification to the client; 

receiving a request for information and a credential and the 
session identification from the client; 

determining whether the session identification is valid; 

determining whether the credential is valid for both the 
client and the session data; 

sending the information to the client in response to the 
session identification and the credential being valid. 

22. A method in a data processing system for managing an 
information request, comprising: 

receiving a request for information and a session 
identification and a first credential from a client; 

determining whether the session identification is valid; 

retrieving a session data structure including a second 
credential in response to the session identification being valid; 

determining whether the first credential and the second 
credential match; and 

fulfilling the request for information in response to the 
first credential and the second credential matching. 



THE REFERENCES 



Shi et al. (Shi) 
Dustan et al . (Dustan) 
Bay eh et al . (Bay eh) 



5,875,296 Feb. 23, 1999 

5,884,312 Mar. 16, 1999 

6,098,093 Aug. 1, 2000 

(filed Mar. 19, 1998) 



THE REJECTIONS 

The claims stand rejected as follows: claims 22-29, 51-58 
and 62 under 3 5 U.S. C. § 102(b) as anticipated by Dustan; 
claims 9-17, 38-46, 60 and 63 under 35 U.S.C. § 103 as obvious 
over Dustan in view of Shi; and claims 15, 27, 44 and 56 under 35 
U.S.C. § 103 as obvious over Dustan in view of Bayeh. 
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OPINION 

We affirm the aforementioned rejections. 

The appellants indicate that the claims stand or fall in 
three groups: 1) claims 22-29 and 51-58, 2) claims 9-17, 38-46, 
60 and 63, and 3) claim 62 (brief, page 4). Although, in 
addition to Dustan, Bayeh is applied to some of the claims in the 
first and second groups, the appellants do not argue the separate 
patentability of the claims to which Bayeh is applied. We 
therefore limit our discussion to claim 62 and one claim in each 
of the other groups, i.e., claims 22 and 9. See In re Ochiai , 71 
F.3d 1565, 1566 n.2, 37 USPQ2d 1127, 1129 n.2 (Fed. Cir. 1995); 
37 CFR § 1.192 (c) (7) (1997) . 

Claim 22 

Dustan discloses a system and method for securely accessing 
information from disparate data sources through a network 
(col. 1, lines 8-10). The user of a client provides an account 
number and a password (col. 8, lines 64-65). In response, a 
database server verifies the user's account number and password 
(col. 9, lines 1-3). The database server generates a unique 
session identification number (session id) and stores it locally 
in a user table such that it is associated with the user's 
account number (col. 9, lines 9-11). The database server then 
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provides the session id and account number back to the client 
where it is stored (col. 9, lines 13-14). When requesting 
information the client "also provides the session id and account 
number back to database server 22 where it ul is once again 
verified" (col. 9, lines 22-24). After the verification, 
information is provided back to the user (col. 9, line 35). 

The appellants argue that Dustan does not disclose 
"retrieving a session data structure including a second 
credential in response to the session identification being valid" 
or "determining whether the first credential and the second 
credential match" (brief, page 5) . 

Dustan 's user account number that is associated with the 
session id and is stored by the database server (col. 9 lines 9- 
11) corresponds to the appellants' session data structure 
including a second credential. The user account number provided 
by the client to the database server when information is 
requested corresponds to the appellants' first credential 
(col. 9, lines 22-24). When the session id/account number pair 
provided by the client with the information request is verified 

1 We find that "it" refers to the session id/account number 
pair. This finding is supported by Dustan 's disclosure that 
after a user requests information "the session id and account 
number are verified against a user table to ensure that they are 
valid" (col. 16, lines 52-54). 
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against a user table (col. 9, lines 22-28; col. 16, lines 52-54), 
that verification requires verifying the session id and verifying 
its associated account number in the table. That verification of 
the account number (the appellants' first credential) necessarily 
requires retrieving the account number previously stored by the 
database server (the appellants' second credential) and comparing 
the account numbers . 

Hence, we are not convinced of reversible error in the 
examiner's rejection of the appellants' claim 22. 

Claim 9 

The appellants argue that "none of the cited references 
teach or suggest the claimed steps of 'determining whether the 
credential is valid for both the client and the session data' or 
'sending the information to the client in response to the session 
identification and the credential being valid' (brief, page 7) . 

Regarding the appellants' claim requirement of "sending the 
information to the client in response to the session 
identification and the credential being valid", Dustan verifies 
the session id/account number pair and then sends the requested 
information to the client (col. 9, lines 22-35). 

As for the claim requirement of "determining whether the 
credential is valid for both the client and the session data", 
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Dustan's database server verifies the account number and password 
provided by the user, generates a session id, stores the 
session id locally in a user table such that it is associated 
with the user's account number, and sends the session id and the 
account number back to the client where they are stored (col. 8, 
line 63 - col. 9, line 3; col. 9, lines 8-14). Thus, when the 
session id/account number pair is again verified (col. 9, 
lines 22-28) , the account number is verified both with respect to 
the client and the session id with which the account number is 
associated in the user table. 

Thus, we conclude that the method claimed in the appellants' 
claim 9 would have been obvious to one of ordinary skill in the 
art over the applied prior art. 2 

Claim 62 

Claim 62 claims a computer program product having 
instructions for carrying out the method of claim 22. Dustan's 
computer-implemented method necessarily includes program 
instructions for carrying out that method. As discussed above 
regarding the rejection of claim 22, Dustan's method includes the 
steps required by that claim. 



2 Any relevant disclosures in Shi are merely cumulative to 
those in Dustan. 
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The appellants' only argument with respect to claim 62 is 
that the final rejection does not include a rejection of that 
claim (brief, page 8) . Although, in the final rejection, 
claim 62 is not included in the statement of the rejection, the 
explanation of the rejection begins with u [r]egarding claims 20, 
25, 26, 28, 51, 54, 57 and 62 . .." (final rejection mailed 
May 22, 2003, paper no. 7, page 2). Thus it is clear that 
claim 62 is rejected and that the examiner's omission of that 
claim from the statement of the rejection was inadvertent. 

Thus, we are not convinced of reversible error in the 
examiner's rejection of claim 62. 
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The rejections of claims 22-29, 51-58 and 62 under 35 U.S. 
§ 102(b) over Dustan, claims 9-17, 38-46, 60 and 63 under 
3 5 U.S. C. § 103 over Dustan in view of Shi, and claims 15, 27, 
and 56 under 35 U.S.C. § 103 over Dustan in view of Bay eh, are 
affirmed. 

No time period for taking any subsequent action in 
connection with this appeal may be extended under 37 CFR 
§ 1.136(a) . 



AFFIRMED 




Lee E. Barrett 
Administrative Patent Judge 
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Anita Pellman Gross 
Administrative Patent Judge 



TJO/eld 
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